Q: What is “shadow AI” in health care? A: “Shadow AI” is the use of AI tools or applications by employees or end users without formal approval or oversight from a health system’s IT or security department. Examples include AI-powered chatbots, machine-learning models, and data-visualization tools that can expose the organization to data-security and compliance risks. Q: How widespread is shadow AI among health care workers? A: Surveys found shadow AI is common; one Wolters Kluwer report found 57% of health care professionals had encountered or used unauthorized AI, and a related survey reported 40% had encountered an unauthorized tool while 17% admitted using one. Many staff said they turn to unapproved tools to speed workflows or because approved tools lack needed functionality. Q: What risks does shadow AI create for patients and health systems? A: Shadow AI can create data-security and compliance vulnerabilities, increase the risk of patient-safety errors, and contribute to costly breaches; one report said the average security breach in health care cost more than $7.4 million in 2025. Patients also express concerns that AI could reduce trust, lead to miscommunication, and be used without sufficient human oversight. Q: How can health systems find shadow AI already in use? A: Run a quick, respectful inventory by asking teams what AI tools they use and why, and use app and network logs to spot unknown or unsanctioned tools, prioritizing anything that touches patient data. Talk with frontline staff about the specific tasks — like note writing, data pulls, scheduling, or coding — that drive use of unapproved tools. Q: What are effective ways to provide safe alternatives to shadow AI? A: Stand up approved AI tools for top pain points within weeks rather than months, create a “safe sandbox” for testing with de-identified data, and publish an up-to-date list of approved tools and their use cases. Making approved options fast and easy to access reduces the incentive for staff to use unsanctioned apps. Q: What data protections should be required for approved AI tools? A: Require that no patient-identifiable data be sent to tools that store prompts or responses outside your control and enforce enterprise controls such as encryption, zero retention, access logs, role-based permissions, and watermarking of AI text. Also redact identities when possible, use de-identified or synthetic data for development, and add strong vendor terms like HIPAA compliance, no training on your data, incident-response commitments, and the right to audit. Q: How should clinicians involve patients when AI is used in care? A: Tell patients in plain language when AI helps write or summarize notes, assists in diagnoses, or suggests treatments, and show disclosures in visit summaries and patient portals. Ask for opt-in consent before using AI in sensitive areas such as mental health, insurance decisions, or diagnostic support, since many patients prefer informed consent. Q: What practical steps help restore patient trust while managing shadow AI? A: If you ask how to manage shadow AI in healthcare, start by listening to staff, shipping safe approved tools quickly, establishing clear governance and policies, and making consent and transparency the default. Combine human review requirements, testing for accuracy and fairness, logging and monitoring, and a clear incident plan, since surveys found more than 80% said trust would increase if accountability measures were in place.